@zuplo/editor@1.0.39741968406
Local development editor for the Zuplo CLI
AI Security Review
scanned 14d ago · by lpm-firewall-aiStatic inspection found a concrete cross-origin exposure in the local editor API: arbitrary origins are allowed to read and write project files while the server is running. This is a runtime vulnerability, not evidence of malicious install-time behavior, so warn rather than block publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user visits a hostile webpage while the local editor server is running.
Impact
Project files may be disclosed to the webpage and sent elsewhere, or altered.
Mechanism
The server reflects the request origin in CORS and exposes file read and write routes without an authentication check in the inspected handlers.
AI rationale
Static inspection found a concrete cross-origin exposure in the local editor API: arbitrary origins are allowed to read and write project files while the server is running. This is a runtime vulnerability, not evidence of malicious install-time behavior, so warn rather than block publication.
Evidence
dist/chunks/chunk-C7VL3DX7.jsdist/index.jsdist/chunks/chunk-7QJXNUVM.jsdist/chunks/chunk-FELEIEAB.js
Network endpoints1
localhost:9100
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The package exports a runtime entry point for its local editor server.
- The server binds to the configured localhost host and starts explicitly; the configured default port is 9100.
- The app reflects each request origin in CORS, allows all methods and headers, and mounts its API under /api.
- The API exposes project file reads and writes under /api/v1/deployments/:deploymentName/fs; reads return file contents and writes accept request bodies.
- Filesystem paths are resolved under the configured project directory, and traversal segments are rejected.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/client/static/js/main-BTlH1BLY.jsView file
9`+e.stack}}var pe=Object.prototype.hasOwnProperty,me=t.unstable_scheduleCallback,he=t.unstable_cancelCallback,ge=t.unstable_shouldYield,_e=t.unstable_requestPaint,ve=t.unstable_now...
L10: `).replace(ld,``)}function dd(e,t){return t=ud(t),ud(e)===t}function fd(e,t,n,r,a,o){switch(n){case`children`:typeof r==`string`?t===`body`||t===`textarea`&&r===``||zt(e,r):(typeof...
L11: `,``):String(n.body);return{path:t,submission:{formMethod:i,formAction:a,formEncType:n.formEncType,formData:void 0,json:void 0,text:e}}}else if(n.formEncType===`application/json`){...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/client/static/js/main-BTlH1BLY.jsView on unpkg · L9dist/client/static/js/codemirror-6ITIKbGP.jsView file
7contains invisible/control Unicode U+200B (zero width space)
height: `+(r-t)+`px`))}function d(t,n,r){var a=R(i,t),o=a.text.length,d,f;function p(n,r){return jr(e,B(t,n),`div`,a,r)}function m(t,n,r){var i=Lr(e,a,null,t),o=n==`ltr`==(r==`after`)?`left`:`right`;return p(r==
Critical
Findings
1 Critical2 High5 Medium4 Low
CriticalTrojan Source Unicodedist/client/static/js/codemirror-6ITIKbGP.js
HighCross File Remote Execution Contextdist/client/static/ts.worker-DFduhuek.js
HighSemantic Analysis Limiteddist/client/static/js/GraphiQLConsole-CCke_ud2.js
MediumDynamic Requiredist/client/static/js/main-BTlH1BLY.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/client/static/ts.worker-DFduhuek.js
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zuplo/editor@1.0.39741968406.
See all versions of @zuplo/editor for other recorded verdicts.
- Review the evidence and your use of @zuplo/editor@1.0.39741968406 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.